Deducing Protobuf Schema and Datatypes

Question

I have a number of protobuf files but no .proto schema file!

cat myfile.pbuf | protoc --decode_raw > outputfile.txt

Using the above command, I was able to decode the file into a somewhat readable protobuf format (Thanks):

1: 1
2: ""
2 {
  1: 0x40133f7ced916873
  2: 0x3ff70e5604189375
  3: 0xbfd23d70a3d70a3d
  4: 0x3fb999999999999a
}
2 {
  1: 0x4022e7ef9db22d0e
  2: 0x4006ed916872b021
  3: 0xbfe1cac083126e98
  4: 0x3fc999999999999a
}
2 {
  1: 0x402bdcac083126e9
  2: 0x40111374bc6a7efa
  3: 0xbfe9fbe76c8b4396
  4: 0x3fd3333333333333
}
2 {
  1: 0x40324147ae147ae1
  2: 0x401696872b020c4a
  3: 0xbff0e147ae147ae1
  4: 0x3fd999999999999a
}
...

I know without the schema I cannot know the meaning of these values, but I am wondering if there is anything else I can do to deduce what this strangeness is! The protobuf documentation seems to indicate that numerical data is served in 2 or 4 byte chunks, which I could easily convert to ints or floats.

My data does not fit into this format, but I know it to be numerical data! I've never seen a protobuf file with the hex x notation, and there are 16 bytes (way too many for a single number!).

What datatype might this be, is it possible to decode and further without the schema, and are the 1, 2, 3, 4 useful or significant?

score 0 · Answer 1 · answered May 25 '17 at 16:06

Those hex values are actually 8 bytes, not 16. So those values could conceivably be int64s, uint64s, or doubles. 1, 2, 3, and 4 appear to be field numbers in a repeated message. There is no easy way to decode further other than to inspect the data manually and try to guess at the meaning.

Deducing Protobuf Schema and Datatypes

1 Answers1